CVE Vulnerability Catalog

The WP Yelp Review Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Yelp Review Text (imported via wpyelp_download_source) in all versions up to, and including, 9.2 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page.

The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.4 via the 'shortcode' parameter. Unauthenticated attackers can include and execute arbitrary .php files on the server, allowing execution of any PHP code in those files.

The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.2. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode, making it possible for authenticated attackers with subscriber-level access and above to execute arbitrary shortcodes.

The wpForo Forum plugin for WordPress in versions up to and including 3.1.5 is vulnerable to authorization bypass due to improper verification of user authorization. An authenticated attacker with subscriber-level access or higher can take over another guest author's forum post and modify its title, body, author name, and stored owner email address.

Net::IDN::Punycode versions before 2.590 for Perl do not validate UTF-8 input in encode_punycode. A flagged string with malformed bytes can hang, crash, or return a wrong label. Only direct calls to encode_punycode are affected; the decoder is not vulnerable.

Net::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadratic punycode encoding of overlong labels before the length check in to_ascii. Labels with many distinct non-ASCII characters cause quadratic CPU cost. All ASCII conversions in the distribution are affected.

Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded. The XS backend rejects the same label, causing inconsistency between installations.

Net::IDN::Punycode versions before 2.590 for Perl allow CPU exhaustion via quadratic insertion cost when decoding long labels in decode_punycode. No label length limit exists in the to-Unicode direction, enabling CPU exhaustion attacks.

Net::IDN::Punycode versions from 2.302 before 2.590 for Perl leak the output buffer on every rejected label in decode_punycode. No label length limit exists in the to-Unicode direction, allowing memory growth.

The ThumbPress plugin for WordPress in versions up to and including 6.2.1 is vulnerable to unauthorized access due to missing capability checks and nonce verification in the send_deactivation_survey() function. An authenticated attacker with Subscriber-level access or higher can deactivate the ThumbPress plugin by sending a crafted POST request to admin-ajax.

Net::IDN::Punycode versions from 2.301 before 2.590 for Perl allow a heap use-after-free via a decoded code point that reallocates the output buffer in decode_punycode. Decoding an attacker-supplied punycode label reads and writes freed heap memory.

Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read via integer overflow of the delta accumulator in encode_punycode. Large code points can cause the digit index to leave the range of the digit table, leading to memory corruption or crash.

The WP Table Builder – Drag & Drop Table Builder plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 2.2.1. This is due to an operator precedence bug in the post-type guard within the trash_table_bulk() and restore_table_bulk() functions that causes the guard to never fire, combined with a permission callback that only verifies plugin role membership without per-post-type or ownership checks.

The RW Elephant Rental Inventory plugin for WordPress in versions up to and including 2.3.13 is vulnerable to Missing Authorization due to a missing capability check on the toggle_cache() function hooked to the wp_ajax_toggle_cache AJAX action. An authenticated attacker with Subscriber-level access or higher can toggle the plugin's cache setting by sending a POST request to admin-ajax.

The Hostel plugin for WordPress in versions up to and including 1.1.8 is vulnerable to Stored Cross-Site Scripting via the 'custom_currency' parameter and the 'locale_url' setting due to insufficient input sanitization and output escaping. An authenticated attacker with Administrator-level access can inject arbitrary web scripts into pages that execute when a user visits the injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

The Tutor LMS plugin for WordPress in versions up to and including 4.0.7 is vulnerable to Insecure Direct Object Reference via the tutor_quiz_builder_save AJAX action due to missing validation that nested question_id, answer_id, deleted_question_ids[], and deleted_answer_ids[] values belong to a quiz/topic/course the requester is authorized to manage. An authenticated attacker with Instructor-level access or higher can overwrite content and re-parent arbitrary quiz questions/answers belonging to other instructors or administrators, and delete arbitrary quiz question and answer rows.

The WP User Manager plugin for WordPress in versions up to and including 2.9.18 is vulnerable to unauthorized modification of data due to a missing capability check on the Connect::complete() function. The function is registered on the admin_init hook and performs no current_user_can() or nonce verification before fetching Stripe credentials and writing them into the wpum_settings option. An authenticated attacker with Subscriber-level access or higher can hijack the site's Stripe integration, routing all payments to their own Stripe account.

The Live Composer plugin for WordPress in versions up to and including 2.1.21 is vulnerable to Stored Cross-Site Scripting via 'dslc_module_downloads_output' Shortcode Content due to insufficient input sanitization and output escaping. An authenticated attacker with contributor-level access or higher can inject arbitrary web scripts into pages that execute when a user visits the injected page.

The Custom Field Template plugin for WordPress in versions up to and including 2.7.8 is vulnerable to Insecure Direct Object Reference via edit_meta_value due to missing validation on a user-controlled key. An authenticated attacker with contributor-level access or higher can delete arbitrary media attachments site-wide by supplying any numeric attachment ID in the file-field parameter alongside the corresponding delete flag, causing content loss and broken pages.

The BM Content Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ux_cb_remove_layout_ajax() and ux_cb_tools_export_ajax() functions in all versions up to, and excluding, 3.17.1. Authenticated attackers with Subscriber-level access and above can delete arbitrary files on the server.